CVE-2025-58445
BaseFortify
Publication date: 2025-09-06
Last updated on: 2025-09-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| runatlantis | atlantis | to 0.35.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an information disclosure issue in the Atlantis application where the /status API endpoint publicly exposes detailed version and build information without requiring authentication. This endpoint reveals sensitive metadata such as software version, build details, dependencies, and system configurations. Attackers can use this information to identify specific versions and target known vulnerabilities associated with those versions, potentially compromising the system. [1]
How can this vulnerability impact me? :
The vulnerability can allow attackers to gather detailed version information about the Atlantis service, which they can cross-reference with public vulnerability databases to find known exploits. This can lead to targeted attacks against the system, increasing the risk of compromise if critical vulnerabilities exist in the exposed version. Although the base severity is low, the risk can be higher depending on the disclosed version's vulnerabilities. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The exposure of sensitive system information through the /status endpoint violates security best practices outlined in standards such as OWASP Top 10 and NIST SP 800-53, which recommend minimizing publicly accessible sensitive information. While the text does not explicitly mention GDPR or HIPAA, such information disclosure could negatively impact compliance by increasing the risk of unauthorized access and potential data breaches. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by issuing an unauthenticated GET request to the /status endpoint of your Atlantis service. For example, using the command: curl http://<atlantis-server>/status. If the response includes detailed version, build, dependency, or system configuration information, your system is vulnerable to this information disclosure. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /status endpoint so that it is not publicly accessible, or limiting the information it discloses to internal and secured channels only. Since no fix is currently available, controlling access to this endpoint reduces the risk of attackers obtaining sensitive version information and targeting known vulnerabilities. [1]